Attacks on web sites in recent years have resulted in severe disruption in network services. These attacks can take any one of a number of forms including, but not limited to, SYN flooding or denial of service attacks.
In a SYN flooding attack an attacker overloads a victim's site to the point where it cannot cope with incoming traffic. Such an attack, typically, focuses on an inherent characteristic of TCP based services.
Essentially, TCP services rely on a three-way hand shaking protocol on connection set up. A client wishing to make connection with a host sends a synchronization signal (SYN) to the host and the host responds to the client with a SYN acknowledgement (ACK) reply. The client then returns an acknowledgement and the connection is established. The handshaking protocol is illustrated in FIG. 1.
Upon completion of a connection the client forwards a finish (FIN) packet to the host indicating that there will be no further data or packets directed to the host and the connection is thereafter closed.
In a SYN flooding attack the attacker will typically use a false or invalid source address such that when the host returns the SYN/ACK message it does not reach a valid client. Under the TCP protocol the host stores half opened connections i.e. connections for which the third leg of the three way protocol has not been completed for a set period of time or until a system time out occurs. If, during this time interval, multiple new half opened connections are established at the host site the memory allocated to retaining such connections becomes swamped and eventually is unable to receive any more SYN packets. At this stage the server or host will crash or will not respond to any new connections and the site goes out of service. Because the host is unable to receive further data the attacker has been successful in generating what is known as a denial of service attack. Denial of service attacks have become an increasingly prevalent form of security threat and the problem, so far, has been quite difficult to solve. Several countermeasures have been proposed and can be characterized as firewall and router filtering, operating system improvements, protocol improvements and intrusion detection.
Considerable prior art exists in the area of security attacks and the problem is well described in a publication by C. Schuba, I. Krsul, M. Kuhn, E. Spafford, A. Sundaram and D. Zamboni entitled “Analsyis of a denial of service attack on TCP”, published in the Proc., 1997 IEEE Symp. Security and Privacy. The Schuba et al. paper describes the problem and the classical solutions for a proxy service: the TCP relay and the semitransparent TCP gateway. In those two solutions, a fire wall intercepts the TCP connections, maintains the states of the TCP state machine and introduces new packets to avoid the attacks.
The proxy solutions according to this publication have to maintain, for each connection, the states of the corresponding TCP state machine. This mechanism needs a lot of resources and can be itself the target of a new denial of service attack. Thus, the high cost of the computation overhead makes this solution inappropriate for network routers or switches.
A second prior art solution which is closer to the present invention is described by H. Wang, D. Zhang and K. G. Shin, “Detecting SYN flooding attacks”, Proc. Infocom 2002. The method according to Wang et al. relies on a counting argument on the SYN and FIN packets on the TCP connections. Those packets should go in pairs in any well behaved connection. Thus, the number of SYN packets should match roughly the number of FIN packets. The simplicity of this method lies in the stateless and low computation overhead which makes the detection mechanism itself immune to flooding attacks. This simplicity allows the detection to be performed in the leaf routers that connect end hosts to the Internet.
The counter mechanism according to Wang et al. has a major drawback. If attackers know exactly the detection protocol described by this method they may thwart this approach simply by overflooding the routers with synchronized SYN and unrelated, often invalid FIN packets. Hence the SYN counter and the FIN counter would be roughly the same. However, the victim's TCP/IP stack would be open to many half-opened connections that would not be closed by the invalid FIN packets. This corresponds to the original denial of service attack.
U.S. Pat. No. 6,321,338 which issued Nov. 20, 2001 to Porras et al. and entitled “Network Surveillance”, also provides prior art for this technology. According to the Porras et al. patent there is provided a method of network surveillance including receiving network packets handled by a network entity and building at least one long term and at least one short term statistical profile from a measure of the network packets that monitors data transfers, errors or network connections. A comparison of the statistical profiles is used to determine whether the difference between the statistical profiles indicates suspicious network activity.
The U.S. Pat. No. 6,321,338 further discloses, in addition to the details mentioned above, that intensity measures of event streams e.g. ICMP packets, are particularly suited for detecting flooding attacks. Furthermore, the patent discloses that intensity measures that correlate SYN to SYN_ACK messages, volume analysis of SYN/RST messages or TCP/FIN messages are useful to detect port availability or scanning attacks.
A second patent of interest is U.S. Pat. No. 5,958,053 which issued on Sep. 28, 1999 to Denker entitled “Communications protocol with improved security”. According to the Denker patent the invention therein includes two new first level protocols and several embodiments of a second level protocol. The two new first level protocols of the invention include the TCP2B protocol and the TCP2E protocol. In the TCP2B protocol both client and server indicate their support for this protocol using one or more bits in the TCP header. According to the TCP2B protocol the client retransmits its requested options in the ACK message so the server need not store the options after the connection request. In the TCP2E protocol the server maintains a Friends Table listing addresses of devices recently observed to be in compliance with TCP. If a client's address is on the Friends Table the connection request is processed according to TCP. Otherwise the server sends an acknowledge message to the client to prompt the client to send a reset (RST) message. The client's address can then be added to the Friends Table.
The U.S. Pat. No. 5,958,053 discloses the use of a hashing function on the source and destination IP addresses and port numbers plus a secret key, known only to the server to differentiate SYN packets. Additionally, the patent discloses keeping a hash table that includes counters corresponding to respective clients to detect unsuccessful attempts as would occur with a SYN flood attack. Each counter is decremented after receiving a SYN message from its corresponding service and incremented when a successful connection is established between the client and the server upon the reception of the ACK from the client.
Denial of service of attacks often employ TCP setup SYN messages to flood target stacks with fake connection attempts. In order to detect such attacks a number of statistics-based heuristics have been developed which count SYN versus FIN messages and flag a skew as an attack. Unfortunately, the attacker can fool a number of these systems by flooding with as many FINs as SYNs but keeping the FINs unrelated to the SYNs.
This is detectable also if the detection system is willing to maintain a table of all SYNs and only counting those FINs which correspond to a valid SYN. Unfortunately, in high bandwidth applications it may not be possible to maintain such a large table of connections.
The solution provided by U.S. Pat. No. 5,958,053 just monitors the connections based on the IP addresses and port numbers.
The best prior art solutions known to the inventors observe traffic and accumulate statistics based on SYNs versus FINs, and flagging an attack if a discrepancy exists. There is no correspondence check between the outgoing SYNs and incoming FINs. This leaves a hole which is also exploitable by a savvy attacker since the attacker can flood a victim with SYN packets and non-corresponding FIN packets. The victim accumulates half-opened connections and the detector is fooled.
Co-pending application Ser. No. 10/158,115 the contents of which are incorporated herein by reference discloses an improvement on the prior art by maintaining a correspondence between SYNs and FINs thereby closing the security hole. This is done by using a hashing function to map SYN messages to corresponding FIN messages.
The aforementioned application also provides a coherent way to deal with reset packets.